Remove dependency on tink-cc KMS extensions from tink-py

This is no longer needed because KMS extensions are now natively implemented in Python.

PiperOrigin-RevId: 524119016

4 files changed, 24 insertions, 37 deletions

diff --git a/python/WORKSPACE b/python/WORKSPACE
index 3a34ee10b..ffaffec75 100644
--- a/python/WORKSPACE
+++ b/python/WORKSPACE
@@ -5,16 +5,6 @@ local_repository(
     path = "../cc",
 )
 
-local_repository(
-    name = "tink_cc_awskms",
-    path = "../cc/integration/awskms",
-)
-
-local_repository(
-    name = "tink_cc_gcpkms",
-    path = "../cc/integration/gcpkms",
-)
-
 # Need to load rules_python earlier as proto uses an older version which is
 # incompatible with our Python implementation will load
 load("@tink_py//:tink_py_deps.bzl", "tink_py_deps")
@@ -32,15 +22,3 @@ tink_cc_deps()
 load("@tink_cc//:tink_cc_deps_init.bzl", "tink_cc_deps_init")
 
 tink_cc_deps_init()
-
-load("@tink_cc_awskms//:tink_cc_awskms_deps.bzl", "tink_cc_awskms_deps")
-
-tink_cc_awskms_deps()
-
-load("@tink_cc_gcpkms//:tink_cc_gcpkms_deps.bzl", "tink_cc_gcpkms_deps")
-
-tink_cc_gcpkms_deps()
-
-load("@tink_cc_gcpkms//:tink_cc_gcpkms_deps_init.bzl", "tink_cc_gcpkms_deps_init")
-
-tink_cc_gcpkms_deps_init()
diff --git a/python/tink_py_deps.bzl b/python/tink_py_deps.bzl
index 86751727d..9e7dc5b88 100644
--- a/python/tink_py_deps.bzl
+++ b/python/tink_py_deps.bzl
@@ -1,12 +1,16 @@
-"""
-Dependencies of Python Tink
-"""
+"""tink-py dependencies."""
 
-load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
+load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive", "http_file")
 
 def tink_py_deps():
-    """ Loads dependencies of Python Tink.
-    """
+    """Loads dependencies of tink-py."""
+    if not native.existing_rule("google_root_pem"):
+        http_file(
+            name = "google_root_pem",
+            executable = 0,
+            urls = ["https://pki.goog/roots.pem"],
+            sha256 = "9c9b9685ad319b9747c3fe69b46a61c11a0efabdfa09ca6a8b0c3da421036d27",
+        )
 
     if not native.existing_rule("rules_python"):
         # Release from 2022-07-15
diff --git a/python/tink_py_deps_init.bzl b/python/tink_py_deps_init.bzl
index 5f5d2941b..01fdc432d 100644
--- a/python/tink_py_deps_init.bzl
+++ b/python/tink_py_deps_init.bzl
@@ -1,8 +1,7 @@
-"""
-Initialization of dependencies of Python Tink
-"""
+"""Initialization of tink-py dependencies."""
 
 load("@rules_python//python:pip.bzl", "pip_install")
+load("@pybind11_bazel//:python_configure.bzl", "python_configure")
 
 def tink_py_deps_init(workspace_name):
     pip_install(
@@ -10,3 +9,9 @@ def tink_py_deps_init(workspace_name):
         quiet = False,
         requirements = "@" + workspace_name + "//:requirements.txt",
     )
+
+    # Use `which python3` by default [1] unless PYTHON_BIN_PATH is specified [2].
+    #
+    # [1] https://github.com/pybind/pybind11_bazel/blob/fc56ce8a8b51e3dd941139d329b63ccfea1d304b/python_configure.bzl#L434
+    # [2] https://github.com/pybind/pybind11_bazel/blob/fc56ce8a8b51e3dd941139d329b63ccfea1d304b/python_configure.bzl#L162
+    python_configure(name = "local_config_python", python_version = "3")
diff --git a/python/tools/distribution/build_linux_binary_wheels.sh b/python/tools/distribution/build_linux_binary_wheels.sh
index 69ac3359e..e710a013a 100755
--- a/python/tools/distribution/build_linux_binary_wheels.sh
+++ b/python/tools/distribution/build_linux_binary_wheels.sh
@@ -55,18 +55,18 @@ unzip -o "${PROTOC_ZIP}" -d /usr/local bin/protoc
 # Setup required for Tink.
 export TINK_PYTHON_SETUPTOOLS_OVERRIDE_BASE_PATH="${TINK_PYTHON_ROOT_PATH}/.."
 
-# Workaround for grpc which expects a python2 installation, which is not present
-# in the manylinux2014 container. Cannot be an empty string, otherwise Bazel
-# will fail.
-export PYTHON2_BIN_PATH="non_existent_file"
-export PYTHON2_LIB_PATH="non_existent_file"
-
 # Required to fix https://github.com/pypa/manylinux/issues/357.
 export LD_LIBRARY_PATH="/usr/local/lib"
 
 for v in "${!PYTHON_VERSIONS[@]}"; do
   (
     # Executing in a subshell to make the PATH modification temporary.
+    # This makes shure that `which python3 ==
+    # /opt/python/${PYTHON_VERSIONS[$v]}/bin/python3`, which is a symlink of
+    # `/opt/python/${PYTHON_VERSIONS[$v]}/bin/python${v}`. This should allow
+    # pybind11_bazel to pick up the correct Python binary [1].
+    #
+    # [1] https://github.com/pybind/pybind11_bazel/blob/fc56ce8a8b51e3dd941139d329b63ccfea1d304b/python_configure.bzl#L434
     export PATH="${PATH}:/opt/python/${PYTHON_VERSIONS[$v]}/bin"
     pip wheel .
   )